Clock Control Sequence Reconstruction in the Generalized Shrinking - - PowerPoint PPT Presentation

Outline Introduction The Attack Experiment Conclusions Future Work

Clock Control Sequence Reconstruction in the Generalized Shrinking Generator

Jan Inge Trontveit June 7, 2006

Jan Inge Trontveit Clock Control Sequence Reconstruction in the Generalized Shrinking Generator

Outline Introduction The Attack Experiment Conclusions Future Work

Outline

1 Outline 2 Introduction 3 The attack 4 Experiment 5 Conclusions 6 Future Work

Jan Inge Trontveit Clock Control Sequence Reconstruction in the Generalized Shrinking Generator

Outline Introduction The Attack Experiment Conclusions Future Work Introduction

The Shrinking Generator

Jan Inge Trontveit Clock Control Sequence Reconstruction in the Generalized Shrinking Generator

Outline Introduction The Attack Experiment Conclusions Future Work Introduction

Applications

Jan Inge Trontveit Clock Control Sequence Reconstruction in the Generalized Shrinking Generator

Outline Introduction The Attack Experiment Conclusions Future Work Introduction

Problem

Reconstruct the generators initial settings.

Jan Inge Trontveit Clock Control Sequence Reconstruction in the Generalized Shrinking Generator

Outline Introduction The Attack Experiment Conclusions Future Work Introduction

Methods

Several approaches

A probabilistic coding theory approach(Chambers, Goli´ c) A MAP decoding approach (Johansson) Linear Consistency Test (Molland)

Known-plaintext

Jan Inge Trontveit Clock Control Sequence Reconstruction in the Generalized Shrinking Generator

Outline Introduction The Attack Experiment Conclusions Future Work The Attack

Reduction to step1-stepE

Jan Inge Trontveit Clock Control Sequence Reconstruction in the Generalized Shrinking Generator

Outline Introduction The Attack Experiment Conclusions Future Work The Attack

Phase one

Determine candidate initial states of R For every possible initial state of R, the constrained edit distance between its corresponding output sequence of length N and the intercepted sequence of length M is computed. All the initial states that produce the output sequences from R, whose edit distance from the intercepted output sequence is less than a threshold T, are included in the set of candidate initial states.

Jan Inge Trontveit Clock Control Sequence Reconstruction in the Generalized Shrinking Generator

Outline Introduction The Attack Experiment Conclusions Future Work The Attack

Phase one

Jan Inge Trontveit Clock Control Sequence Reconstruction in the Generalized Shrinking Generator

Outline Introduction The Attack Experiment Conclusions Future Work The Attack

Phase two

Clock control sequence reconstruction Search the edit distance matrix for optimal and suboptimal paths With zero noise, we only need to reconstruct the optimal paths In the presence of noise, we also need to reconstruct suboptimal paths The number of paths to be reconstructed is controlled by the value of D

Jan Inge Trontveit Clock Control Sequence Reconstruction in the Generalized Shrinking Generator

Outline Introduction The Attack Experiment Conclusions Future Work The Attack

Phase two

We increase D until the correct clock control sequence is found Example of a reconstructed clock control sequence: 2,0,3,3,0,1,2,0 This would correspond to the following binary sequence: 0011000100011010011 Finally giving us the initial state of the clocking register

Jan Inge Trontveit Clock Control Sequence Reconstruction in the Generalized Shrinking Generator

Outline Introduction The Attack Experiment Conclusions Future Work Experiment

Description

Implementation in C++ 50 initial states Noise level from 0 to 0.45 3 different LFSR lengths

Jan Inge Trontveit Clock Control Sequence Reconstruction in the Generalized Shrinking Generator

Outline Introduction The Attack Experiment Conclusions Future Work Experiment

Description

The number of paths to be reconstructed in order to find the true clock control sequence should be as small as possible. This number depends on D Given a certain level of noise, the maximum value of D, denoted by Dmax, has been analyzed experimentally.

Jan Inge Trontveit Clock Control Sequence Reconstruction in the Generalized Shrinking Generator

Outline Introduction The Attack Experiment Conclusions Future Work Experiment

Description

For a fixed value of D, the optimal and suboptimal paths are determined. We start from D = 0 and we increment D until the solution is found. The value of Dmax is stored.

Jan Inge Trontveit Clock Control Sequence Reconstruction in the Generalized Shrinking Generator

Outline Introduction The Attack Experiment Conclusions Future Work Experiment

Results

pl p diff n path E largest step n skipped N 6 0.000000 12 144 5 3 10 21 6 0.000000 12 142 5 2 10 21 6 0.000000 11 423 5 2 11 21 6 0.000000 15 7 5 1 7 21 6 0.000000 12 58 5 1 9 21 6 0.000000 6 1327 5 5 15 21 6 0.000000 16 1 5 6 21 6 0.000000 3 1985 5 4 19 21 6 0.000000 10 462 5 2 12 21 6 0.000000 3 3685 5 5 18 21

Jan Inge Trontveit Clock Control Sequence Reconstruction in the Generalized Shrinking Generator

Outline Introduction The Attack Experiment Conclusions Future Work Experiment

Results

Jan Inge Trontveit Clock Control Sequence Reconstruction in the Generalized Shrinking Generator

Outline Introduction The Attack Experiment Conclusions Future Work Conclusions

Conclusions

The procedure always finds the solution Even if the level of noise is relatively high Dmax depends on the length of the necessary clock control sequence Dmax depends on the noise level Inexact estimation of N introduces noise

Jan Inge Trontveit Clock Control Sequence Reconstruction in the Generalized Shrinking Generator

Outline Introduction The Attack Experiment Conclusions Future Work Future Work

Future Work

Estimation of N Longer LFSRs The Alternating Step Generator

Jan Inge Trontveit Clock Control Sequence Reconstruction in the Generalized Shrinking Generator

Outline Introduction The Attack Experiment Conclusions Future Work Future Work

Feedback

Opponent and Questions...

Jan Inge Trontveit Clock Control Sequence Reconstruction in the Generalized Shrinking Generator